Posted
by
Zonk
on Tuesday January 03, 2006 @04:09PM
from the quick-quick dept.

frankie writes "ZDNet is reporting on the latest dire pronouncements about the WMF vulnerability. The problem is so serious that security experts are urging IT firms to use the unofficial patch. Microsoft's current goal is to release the update on Tuesday." From the ZDNet article: "This is a very unusual situation -- we've never done this before. We trust Ilfak, and we know his patch works. We've confirmed the binary does what the source code said it does. We've installed the patch on 500 F-Secure computers, and have recommended all of our customers do the same. The businesses who have installed the patch have said it's highly successful" It's big enough that even mainstream media is covering the flaw.

So if this vulnerability is high on the seriousness level, is anyone else wondering the same thing as I am; How and why is it that Microsoft is days behind a third party in releasing a security patch? I mean this is hitting mainstream media, and Microsoft's security patch response team is being bested by some 'guy'?

It looks like Microsoft is allowing its user community to patch problems before it can. Oh no!! That sounds a lot like how the Linux community works. Is this going to be a more common occurence as time goes on?

This guy (he may be reknowned in the security community, but I've never heard of him) was able to successfully bandage a Windows flaw before Microsoft, without access to the Windows source code or any backing from the writers of the program being patched. I doubt he'll need to look far for work for a long time, and if he does, 'Successfully wrote a patch for a Windows flaw independently' looks damn good on his resume. He still has to pay for Windows, sure, but it's not like he's going to be completely unrewarded for his work.

This may sound mean-spirited but I think in this case, and any like it, I couldn't blame the security community if it just threw up its hands and said:

"Oh, what a horrible situation -- we could issue our own fix that we've written to help you out, MS -- it's ready to go, we know it works -- but due to the DMCA, Trusted Computing, numerous restrictive MS EULAs and the general legal climate you and other large proprietary software vendors have created, we are genuinely afraid to release our change, as it has required us to disassemble, reverse-engineer and generally do things that you would sue us for. Sorry. Good luck to your *own* patch team."

Why, from a moral standpoint, should anyone help MS do their QA? They certainly have proven themselves willing to sue anyone for any number of reasons relating to reverse-engineering their code -- after all, their philosophy is that no one outside of their teams should know about the OS internals in this way.

They can't have it both ways -- either welcome the users' rights to improve the system they paid for, or don't.

(Yes, I realize that this patch was made to benefit the public in general, and to defend everyone's systems, not directly to benefit MS. But MS does get a free lunch out of this, in some respects.)

If you're curious as to what all they do, you can take a look here [eweek.com]. A sample quote from the article:

In some cases, particularly when the Internet Explorer browser is involved, the testing process "becomes a significant undertaking," Toulouse said. "It's not easy to test an IE update. There are six or seven supported versions and then we're dealing with all the different languages. Our commitment is to protect all customers in all languages on all supported products at the same time, so it becomes a huge undertaking."

According to this F-Secure's Web log [f-secure.com], it tells what is going wrong with the Windows Metafiles (WMF) vulnerability. It turns out this is not really a bug, it's just a bad design from another era. When Windows Metafiles were designed in late 1980s, a feature was included that allowed the image files to contain actual code. This code would be executed via a callback in special situations. This was not a bug; this was something which was needed at the time. The feature now in the limelight is known as the Escape() function and especially the SetAbortProc subfunction, and has been around since Windows 3.0, shipped in 1990...

It's a bug because it doesn't have the.exe extension- if Microsoft tells us "don't download executables from untrustworthy sources" they mean.exe files- they don't mean.jpg files.

Read the Fucking Back Story: This would be almost 0% issue if any of the following were true:

1. MSIE/SHELLDOC used extensions or mime-types (MSIE) in determining what file format something was [[ This flaw is transparent to users: it can be in almost any file extension ]]

2. MSIE/SHELLDOC had a feature like the mailcap file on UNIX which allows us to only list programs that can operate on untrustworthy files(!)

3. The WMF magic was outside of a critical system component (that could simply be unregistered and removed)

As a result, this is a very serious problem, and by playing Microsoft's tune about how "it's not that big of a deal", you're only making the problem worse.

By the way, someone should (quick!) make some WMF files that use the AbortProc routines to disable printscreen and stuff when they're visible so they can sue MS for DCMA (copy protection circumvention) violations...

No, it wouldn't. That's a bad analogy. Your analogy would more accurately describe a situation where they were sitting on a patch until multiple bug fixes were implemented.

A better analogy would be that Microsoft is withholding the cure for breast cancer until they verify that it doesn't cause patients with other cancers to worsen, that it really does cure breast cancer on more than just one woman, and that it doesn't kill patients outright. with QA, at minimum you've got to verify that a patch can be installed, can be uninstalled if that's an option, fixes the problem, is stable, and passes any baseline usage tests that you have.

The analogy still isn't perfect, but it's far more representative of what a QA process is.

This puts MSFT in an interesting position -- their official patch has to be tested on systems with the unofficial patch. Otherwise there's a possibility that the unofficial patch will break something in the official patch (or vice versa.)

With the unofficial patch already deployed on thousands (millions?) of machines, it would be a big deal if something went wrong.

Even if it means, in contravention of best security practice and all possible "trustworthy computing", knowingly delaying an urgent, critical fix (which would be less troublesome than the first Shatter fix which was pushed out, and only disable a single GDI function that frankly hasn't been used since Windows 3.1 and should never have been used in the first place) for a publically-disclosed, unpatched vulnerability that had been discovered from a 0day exploit, for an indefinite amount of time over a public holiday period while the vulnerability is being "tested"?

When there's realistically no possible way the different L10n's of Windows would affect the GDI32 core because it contains almost no l10n strings anyway, and the vulnerability is in fact a purposely-designed, never-used legacy "feature" that should definitely have been removed in Windows NT or during the Windows 2000 GDI rewrites, or noticed, say, during last months GDI audit?

Despite Microsoft promising that the introduction of the Patch Tuesday would not preclude emergency fixes being issued out-of-cycle and as soon as possible for, ooh, say, critical core Windows vulnerabilities with an enormous number of possible vectors of infection, no effective mitigation and wide, dangerous exploits in the wild with a number of vulnerable machines easily capable of providing an ample breeding ground for supporting wide botnets or enormous worm infections?

Which is exactly what has happened, as Windows has, frankly, just faced the worst single vulnerability in its entire history?*

What the fuck are they doing, deliberately trying to breed another big internet worm?

Sorry, but I'm calling bullshit. I'm a security researcher, and I'm really quite angry at Microsoft's piss-poor handling of this. They couldn't have done much worse if they'd heard about the bug and then have let MSRC take Christmas off anyway.

This was not business as usual. This was an exceptional event (true 0days are actually quite rare to discover in the wild). It could not, and should not, have waited until the next patch cycle. This is exactly the kind of situation upon which a speedy mitigation - hours to days, but definitely not weeks - is absolutely critical, and we should demand that. They should AT LEAST have provided the (untested) hotfix themselves within a day, and pushed it out to Automatic Updates and Windows Update/Microsoft Update within the week after first discovery in the wild - not unrealistic goals for a vendor who wishes to paint themselves as "trustworthy".

They should be brought to task on this one. Behaviour like this is what created the full-disclosure movement in the first place.

* Yes, I'm going to say this one's actually worse than the various active remote vulnerabilities we've had over the years, like the UPnP vuln or the numerous RPC-related vulns. Those, you could at least block with a firewall. This, it's single-payload, multi-vector. It's got plenty of room to drop anything, it's capable of highly metamorphic exploit streams, can be fed online or offline, even spread on media, anything from email to a web page to a simple read-only directory listing or right-click, or uploaded to a site or blog, god help you, rendered inside MSN... the number of potential vectors is so numerous and troublesome it even makes analysis difficult; Windows disregarding filenames and extensions and MIME types and using magic sniffing instead, so you can't even block it effectively using a content-inspecting IDS - that's just the icing on the cake. This is a classic vulnerability, a real ticking Christmas present, a true textbook candidate.

Of course, there's also another question with the WMF patch: many programs still allow exporting to WMF. There wasn't really much of a standard vector graphics format for win32 for a long time - iirc during my undergrad, I would frequently export my Matlab, Maple, and Autocad images to EMF before importing them into Word.Early on, I distincly remember using WMF, mostly because I assumed something with Windows in the name would have better support from Word and the operating system. Presumably other users

To me, it's a general problem of redundancy. Filetype should be defined once and only once. If type X has magic prefix Y, then the server should identify the data as of type X using MIME and leave out magic prefix Y. The client can then stuff magic prefix Y onto the file when saving it.

Once-and-only-once is the first and last rule of good programming. The moment any information appears in more than one place, things start to hit the fan.

I wouldn't call it hundreds.Even so, it probably just a few code libraries to check against as I doubt they check against each and every title listed here:http://support.microsoft.com/gp/lifeselect [microsoft.com]

Probably their main concern is the Enterprise level support they have to comply with and NOT rush a patch out.

I would rather wait a few days to ensure this patch doesn't break anything else than receive a MS fix now that that causes more headaches than it fixes. I've been down that road way too often. I would image they are making sure everything is working the way it is supposed to before releasing it...

the testing will be signed off as soon as the patch breaks one or more of the following: iTunes, Samba, GoogleDesktop, Palm Desktop... they only care about testing against their own applications, breaking third party programs in the process is a bonus, breaking old versions of ms apps while not breaking the latest versions is a double bonus... as it forces an upgrade

Quite possible that the 3rd party patch doesn't fix *the* real problem (or all the problems)It's also possible that MS has found something else also in the same code that can leave them in an embarrassing situation in another week (This I guess is the 2nd issue with the wmf handling in 3 months) if they release just a hurried patch resolving only the problem we're seeing now. But whether or not they should be delaying it at the risk of letting customers face trouble (and gain bad publicity) is, I hope, give

What about 3rd party solutions?
Wait. MS'll patch it next week. We'll do it in 23 languages and thoroughly test it.

Why is it taking so long?
Our team of "designated product specific security experts" look at the problem, figure out how big it is, then how to fix, then fix it, then test the fix, then port it to all the affected platforms and languages.

If you can't figure out that you're running a 3845, with Version 12.3(8T), and the Advanced IP Services feature set, then that's really more your problem than it is Cisco's. (And if you open a TAC case, you can send them the output of 'sh ver,' and they'll happily tell you precisely what file you need to download.)

Cisco traditionally has used a monolithic kernel, which Linux guys poo-poo, but when you control all of the hardware, and you know all of the possible modular components that can be installed i

The answer to your question should be fairly obvious to anyone who has worked for a software development company: quality assurance. Windows is an extremely large and complicated piece of software. Any changes must go through a rigorous testing process, probably using dozens if not hundreds of configurations. Otherwise, Microsoft risks releasing a patch which breaks a few thousand servers/desktops and brings their customers' businesses to a grinding halt."Oops, sorry about that. We forgot to test the pa

The actual root of the problem is in the GDI, which is what handles all basic interface display for Windows. The unofficial patch just disables the call that the exploit uses. Ok, fair enough, but that's a hack, not a fix. That means that anything that legitmately uses that call won't work, and the underlying problem is still there.

Well, testing a fix for a system component like that takes time, espically since it affects a ton of versions.

Now you might ask, why not release a hack fix, and then do a proper patch later? Well as it stands, it's hard enough to get people to update their systems. We fight with it all the time with people here at work. They turn auto updates off since they run simulations at night and don't want it rebooting (even though patch day is known ahead of time) and then never manually patch since they "can't be bothered".

Well, if MS released a patch that broke things, that just makes that many more people stop patching. Remember all the whining and bitching about SP2. There were very few systems that had problems with it, and most that did were spywared to hell, but still there are tons of people that refuse to install it for fear that "it'll break my computer".

Thus the offical patch takes time, as they have to test and make sure that the problem really is fixed, and no new problems were created with the fix. REgression testing isn't quick.

It's not that it's a GDI bug. It's a DESIGN MISFEATURE- the code does exactly what it's intended to do. The problem is that the feature is NOT secure, not a good idea on a system in the first place, and code and images shouldn't even be USING this thing.

F-Secure's hack, and yes, it's a hack, is an adequate fix until MS gets their damn hole that's been lurking since Windows 3.1 fixed.

More importantly, any 3rd party program that incorporates the use of WMF should be redesigned. You can't fix a vulnerability caused by a data structure that is insecure by design and still try to allow programs using WMF to function as normal. The logical thing to do would be to remove WMF implementation from Windows--thus disabling any application that uses WMF and are essentially vectors for potential exploits, then leave it up to the various 3rd party application authors to fix their own design flaws, wh

Now excuse me while I take off my tin foil hat and place my head in the microwave set on high for 10 mins, so I can understand the Corp. BS thats going to come flying through the fan from MS's PR dept.

Its not just the extension that dictates that it's a WMF... Windows in its infinate wisdom also looks at the header bytes of the file and says "ohh! thats a WMF!"
Execute!
im in a damned hurry, hopfully I stated that correctly...ymmv

Its not just the extension that dictates that it's a WMF... Windows in its infinate wisdom also looks at the header bytes of the file and says "ohh! thats a WMF!"

So, in other words, it does exactly the same thing Unix does for every single executable file.

Do a man magic if you don't know what I'm talking about, and/or look into why scripts have that #! as the very first two bytes in order to work automatically.

Windows has gotten bashed for years for relying on file extensions. Here they don't and they get bashed more! Ok, yeah, it's yet another example of deviation from expected behavior, but complain about that, not that they're finally trying to be smarter about files. Hell, most programs will now ignore file extensions and look at the file header -- it's hardly a MS only behavior.

That said, MS's slackness on this issue is ridiculous. Yes, I know that they have to test a patch in a very large test environment to make sure nothing goes "boom", but in this case they would better serve their customers by simply disabling WMF support entirely until they can properly patch things. WMF is not a widely used format -- in the very few cases where it's actually being used you could simply not patch the computer and take appropriate actions to isolate that system. It would be a hell of a lot better than the current situation, especially given how nasty and widespread this exploit is.

That's great, but it's all irrelevant. The HTTP 1.1 protocol says that a browser shouldn't try to guess the MIME type of a document if it's specified by the server. IE ignores this and tries to guess the MIME type anyway.

Note the key difference between an OS (your example) and a browser (reality).

Any HTTP/1.1 message containing an entity-body SHOULD include a Content-Type header field defining the media type of that body. If and only if the media type is not given by a Content-Type field, the recipient MAY attempt to guess the media type via inspection of its content and/or the name extension(s) of the URI used to identify the resource. If the media type remains unknown, the recipient SHOULD treat it as type "application/

It has to do with the MS Windows community expecting extensions to be used to link files to programs exclusively. There is no execute bit in their filesystems. Linux users don't have that mindset. A text file might end in.txt, but it is just as often without an extension. Executables have no extension and anything with.exe is obviously a Win32, Win16, or DOS executable. Linux users also expect data to NOT be given execute priviledges.I'm suprised virus writers waited until this millenium to finally exploi

It has to do with the MS Windows community expecting extensions to be used to link files to programs exclusively

And Linux users don't? Double click on a GIF/JPG/MP3/HTML/etc file in Konqueror or Nautilus (or the file manager of your choice) and what happens? Exactly the same as in Windows -- it launches the executable that's associated with the file.

There is no execute bit in their filesystems.

Yes there is. Admittedly, it's not used very much, and I don't expect that to change anytime soon. Not that it woul

Then and now: Microsoft sucks because they use file extensions and if that doesn't execute they use file content and otherwise mime type.

MS seems to puts real effort into executing everything that you throw at it: "hmm, it doesn't end in.exe,.com,.bat,.pif, or what you may have. Ah, maybe it's a Word macro, let's try that. No that didn't work, but wait, let's see if it's a.wmf in drag and execute any code in that. Hmm, it still won't execute, I give up. " I'm really curious what people will come up

How do you intend to block them? Block anything with extension.wmf? Isn't enough as the file will be identified and handled as wmf, no matter what the extension is.From http://isc.sans.org/diary.php?storyid=994/ [sans.org] you can find that "WMF files are recognized by a special header and the extension is not needed. The files could arrive using any extension, or embeded in Word or other documents."

Because Windows in its infinate wisdom looks beyond the filename and looks at the contents of the file, allowing the following:I save a hacked WMF on the webserver as HeaderPicture.jpg and link it into the webpage with an img tag it will be downloaded as a jpg file, and only then once it gets to my computer does it get handled using the internal WMF code.

It would be easy to block WMF files on the border, but as you can see, not every WMF identifies itself quite so easily.

And, somehow, as if by magic, all of this work will wind down at precisely the right moment so that the WMF patch doesn't have to be released "out of cycle." How convenient! Especially if you're wanting to avoid all of that nasty "Microsoft Releases Emergency Patch" publicity.

Huh? How'd get this modded Insightful? It's pretty much the opposite, actually - considering that F-Secure is in the business of security solutions, it's *expected* of them to uncover new problems, and I at least think it's *GREAT* that they decide to make the information available to everyone instead of just rolling it into the next update for their enterprise products.

Think about it - they're doing good research, AND they're making it available for free, and you still criticise them for exactly that? You're not just looking the gift horse into the mouth, buddy, you're trying to paint the giver in a bad light for attempting to give it to you for free.

One gets the feeling that the MS programmer didn't want to come in over the New Year's holiday to work on some piece of legacy code from 1990 that he was handed several years ago when the last programmer whose responsibility it was, was promoted/left for Google. This latest programmer has never looked into this code before this last weekend.

It may not have been anything like this at all, but this is the feeling one gets.

One also wonders about the job security of the MS programmer who didn't get this fix out in a timely manner.

This is a very small code snippet that prevents the Escape() call with a certain argument. If you allow that, your system is vulnerable; if you don't, it isn't.

There's no way you can preserve the operation of legacy code without preserving the vulnerability, so if your legacy code relies on that behaviour (which is *extremely* unreliable), you're fucked, and there's nothing Microsoft can do to get around it. They're just reticent to bite the bullet.

Excuse me. The hole has been there since 1990. It hasn't been caught by any code or security review since then, despite Mr. Gates change of direction and push to make security the top Microsoft priority how many years ago now? And it's patched by a third party days ahead of the scheduled Microsoft patch.

Businesses are only going to respond to a problem by calling on the person/entity that is supposed to cover it, i.e. the one they're paying, Microsoft, in this case. They're not going to go around installing an independent patch willy-nilly on dozens of computers if it takes another day to get it from Microsoft. Many of these are small businesses without IT departments to advise them one way or the other. The important point here is that by waiting the extra day, a few of them are going to get burned badly and Microsoft will lose much of their trust.

" The usual suspects [google.com] are reporting Microsoft's latest announcement about the WMF vulnerability (link to previous/. article). To quote (link to MS technet article): "Microsoft's goal is to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins." So do you install the unofficial patch (link to previous/. article), or cross your fingers for a week?"

Just further shows that the "editors" don't even "get" their roles as editors. Attributing words that weren't written to the submitter is not something they should be doing. Or if they do, they should use the standard square brackets to indicate that those words weren't said, but were what was implied. Changing the title is fine. Adding additional commentary or extra sources (as Zonk did with the 'From the ZDNet article' bit) is fine. Putting words in people's mouths is a HUGE editorial no-no.

Oh sorry, what I meant was Vista will have ever more voracious hardware requirements, 3-D widgets, DRM up the yin yang, 12 different versions so it runs on everything from the computer to the home theater to the microwave oven, bugs crawling out of everywhere from day one and the same broken piece of shit security model wrapped up in corporate hype and buzztalk for only 30% more retail cost than the version of Windows you're running today.

12 different versions so it runs on everything from the computer to the home theater to the microwave oven

Since we/.ers delight in hearing tales of the successful installation of Linux on any electronic device that will sit still for long enough, perhaps we shouldn't criticise Microsoft for attempting the same with their OS...

To elaborate, what makes a WMF a WMF is a few magic bytes at the beginning of the file. Windows sees these magic bytes and hands the file off to the GDI for processing, regardless of the extension. Hence the "M" in "WMF".It's being disguised as "safe" image files for easier transmission, since the more-awake folks have already blocked *.wmf at the gate. (As a challenge, can anyone see if calling it an HTML file works to trigger the exploit? Or find a site where it's been done?)

IE has a few different MIME types for which it enables the magic. text/plain, application/octet-stream and text/html all enable this magic, because traditionally web servers have determined content type by file extension and have defaulted to one of these types when they don't have an entry for the file extension given.

This was a practical problem during PNG's infancy, when Apache's default configuration didn't know what the.png file extension was and just served them as text/plain. Most webmasters who de

One site (maybe one of ebaumsworld's ads, I believe--I won't link there) tried to do something with it. avast! [avast.com] alerted me with its usual "Caution. A virus has been detected" sound and "abort connection" dialog and all of that. Don't know if it succeeded (nothing unusual now, though my browser did show a naughtier site instead that time; I visited a few times again and it showed my intended site as usual, with much less naughtiness)

On a hasty no-but-seriously note: are you suggesting WMF is wormable? I can't see how; an machine infected with a WMF worm would have to contact another vulnerable machine and somehow induce it into downloading an image file and parsing it. There was a rather feeble attempt at an IM worm over the weekend which fortunately seems to have fizzled, and I can't easily imagine other vectors. (Perhaps I have a we

Funny, I talked about this yesterday; how could a graphic cause something so severe?
This is a picture [fak3r.com]
So now an email, IM, webclick or maybe even a popup could kick off a payload from a graphic? I thought only new things would attack windows rep, as if all the old stuff had been discovered, but now, there's more and more daily!

No problem, always happy to share, but WTF? Can't they call the company whose malware remover gets installed? Why can't they ask them some questions or lean on them to uncover the originator of this scam?

If you are a Windows OneCare user and your current status is green, you are already protected from known malware that uses this vulnerability to attempt to attack systems.

My question in all of this is if it's fixed in this "OneCare" thing, then what's the difference in the rollout to everyone else? Please, God, tell me this isn't some stupid marketing ploy (the delay that is) to get more people on thi

As is typical, the linked-to article [cnn.com] gives people a lot of incorrect impressions (including many that the general public already seems to subscribe to, for the most part).

Just in that brief piece, I can spot three typical points of inaccuracy:

Blurring the line between hardware and software. The use of the phrase "every Windows system shipped since 1990", coupled with the phrase "Windows PCs", seems to subtly (albeit probably unintentionally) imply that Windows is either hardware itself, or irrevokably paired with hardware. (I.e.: "No, that's a Windows PC, it can't run Linux.")

This, of course, is precisely the sort of vague, inaccurate half-understanding that Microsoft wishes end-users to have. If the phrasing of the article made it clear that Windows is not something physical, not something "shipped" in the same sense that a power supply or a mouse is "shipped"-- that there is no such thing as a "Windows PC", only a "PC running Windows"-- perhaps they'd begin to ask tough questions like "Well, are there any alternatives that we could run on our PCs to prevent these problems from affecting us?" These are, in their own small way, subversive questions, anti-authoritarian questions, anti-monopolistic questions-- and thus questions that Microsoft and their ilk don't want people asking.

Use of the overly simplistic term "virus" to describe any sort of computer security breach. I am getting incredibly sick of this. Yes, the biological metaphor was useful to convey the concept of a computer having problems. But it's worked too well. Now, any time I try to explain a non-virus form of computer affliction to a non-techie, they always seem to start out by saying "so it's a virus?" Spyware? "Viruses". Computer running slow? "Viruses." Pop-ups? "Viruses." On numerous occasions with numerous people, I've mentioned the word "spyware", only to have people say "oh, that's the program that gets rid of the viruses?" or something like that. (They confuse the name "Spybot" (as in "Spybot: Search and Destroy")" with the word "spyware".)

And last but not least: Demonization of those eeeeeeeeeevil "hackers". I know the "hacker vs. cracker" war of words is long since lost, but it still irks me when the term used to describe these guys [barnesandnoble.com] (my heroes!) is now synonymous in the public mind with "malicious and destructive computer criminal".

On the bright side, at least they're admitting (finally) that the problems only affect computers running Windows. If I see another story talking about an "email virus" (read: "MS-Outlook-running-on-MS-Windows-only virus/worm/exploit"), my head is going to explode into a fine pink mist.

People, I'm sure, will say that I'm "nitpicking" or being an "English nazi", but one's choice of words does make a difference. The usages here are just reinforcing common vague half-truths and misconceptions that the general population has about computers, and for every article out there that says "Windows PCs" instead of "PCs running Windows", or "viruses" instead of "malware" or "security exploits", it just makes the already-huge problem of user ignorance that much bigger.

Consider the two sentences below:

"Senator Smith has not yet released a statement concerning the situation."

Which one makes Senator Smith out to be a sneaky crook, and which one merely cautious?

The difference is all in the choice of words. Words matter. So anyone who wants to tell me I'm just being nitpicky-- shove it. One's choice of words creates impressions, both conscious and subconscious, in the reader-- and thus, the seemingly

Will Windows Update be able to overwrite the unofficial patch when the official one is released? Does WU do a hash check of some sort to verify if the files that is is replacing are versions that it is allowed to replace?

Nah, tactically speaking, I'd assume that it's best to release a mega-worm about a week and a half to two weeks before patch day. The reason why is simple: if you release it too early and it's bad enough, Microsoft will break stride and release a patch early. On the other hand, if the time to develop a patch and test it (I'm guessing around a week to a week and a half, depending on the difficulty of the patch) is within four or five days of Patch Tuesday, Microsoft is politically better off waiting until Tu

Like antdude [slashdot.org] said above, the real problem with this is that the exploit affects something which is actually a
feature of WMF files. A feature which is used by certain apps.

I have witnessed first hand how Guilfanov's unofficial patch [hexblog.com] will break some legaccy apps. The one in question was a 16-bit app (based on Access 2.0). After applying the patch, it was impossible to print some forms (we received an error). Sure, we uninstalled the patch and printing was OK again.

So therefore the interesting thing about the upcoming Microsoft patch is, how are they going to patch the hole without breaking the legitimate uses of the affected gdi functions???

Got it from some professor at "Yale." The link opens up some WMF file, or at least it tried to, when Firefox asked me what program to open it with. MacAfee caught it then too. A txt file was attached. Beware, I suppose. Here's the full text.

Hello,

We are very sad to say that over the New Year the Campus was subjected to
several acts of mindless vandalism. As well as bricks being thrown through
windows, several members of staff have reported their cars as being the
subject of practical jokes. Some of these cars were filled with water whilst
others had graffiti daubed across them. We have uploaded the pictures of the
graffiti here http://playtimepiano.home.comcast.net/ [comcast.net] in the hope that someone
may recognise the culprits work. If anyone can shed any light on this
unfortunate
incident could they please contact the main office as soon as they have time.

Take care: firefox is scarcely less vulnerable than IE. IIRC, FF will ask permission to launch an external application so you'll have to pay attention. It's not impossible that you might be socially engineered into doing this, or that they may be able to exploit this problem in conjunction with some other FF vulnerabilty.

Best for now to unregister the WMF dll: regsvr32 -u %windir%\system32\shimgvw.dll

If you have a Windows domain and use mostly XP and 2003 machines... try using the built-in 'Software Restriction Policy' to prevent the path %systemroot%/system32/shimgvw.dll this will apply to all of the machines in the domain.

I've implemented this today on the network, but don't be fooled into thinking that this will protect you 100% because it doesn't. The flaw isn't in shimgvw.dll, that dll is just one of the common attack vectors. The flaw is a 'feature' of GDI as many of the/. comments have already pointed out. The only real fix for this will be the official patch next week.

Until the patch is released it wont hurt to take a few simple steps to reduce the attack vectors (emphasis deliberate)

* Educating users about the dangers* Updating AV definitions across the network* Blocking.wmf at the mail and web gateways* Disabling the shimgvw.dll using the above method or the regsvr32 method.

Some people might want to consider the unofficial patch - personally, I wouldn't let it anywhere near the network of 3000+ machines. If something goes wrong, that a lot of cleaning up to do, and Microsoft will not be interested in helping.

Some people might want to consider the unofficial patch - personally, I wouldn't let it anywhere near the network of 3000+ machines. If something goes wrong, that a lot of cleaning up to do, and Microsoft will not be interested in helping.

I rolled the MSI-based [sans.org] version of this patch to around 1,500 client PC's this morning. The MSI cleanly uninstalls and has been tested on the US versions of W2K Server SP4, W2K Pro SP4, WXP Pro Gold, WXP Pro SP1, WXP Pro SP2, W2K3 Gold, and W2K3 SP1.